CVE-2023-46247
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-46247 affects Vyper, a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays may experience a slots allocation issue due to an inaccurate calculation for determining the required number of slots. Prior to version 0.3.8, this calculation was based on `math.ceil(type_.size_in_bytes / 32)`, which can result in rounding errors causing a miscalculation of up to one slot needed when `type_.size_in_bytes` is not a power of 2. This vulnerability could potentially lead to security issues or contract execution failures. Version 0.3.8 addresses this issue by implementing a more precise calculation method.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Vyperlang Vyper
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions